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Using this Manual 



This manual will show you how to use the HP 6473 1 (70322/70320) 
emulator with the firmware resident Terminal Interface. 

This manual will: 

■ Show you how to use emulation commands by executing 
them on a sample program and describing their results. 

B Show you how to configure the emulator for your 
development needs. Topics include: restricting the 
emulator to real-time execution, selecting a target system 
clock source, and allowing the target system to insert wait 
states. 

■ Show you how to use the emulator in-circuit (connected to 
a target system). 

■ Describe the command syntax which is specific to the 
70322/70320 emulator. 

This manual will not: 

B Describe every available option to the emulation 
commands; this is done in the HP 64700 Emulators 
Terminal Interface: User's Reference. 



Organization 



Chapter 1 Introduction to the 70322/70320 Emulator. This chapter briefly 
introduces you to the concept of emulation and lists the basic 
features of the HP 64731 70322/70320 emulator. 



Chapter 2 Getting Started. This chapter shows you how to use emulation 

commands by executing them on a sample program. This chapter 
describes the sample program and how to: load programs into the 
emulator, map memory, display and modify memory, display 
registers, step through programs, run programs, use software 
breakpoints, search memory for data, and perform coverage tests 
on emulation memory. 



Chapter 3 Emulation Topics. This chapter shows you how to: restrict the 

emulator to real-time execution, use the analyzer trigger to cause 
breaks, and run the emulator from target system reset. 



Chapter 4 In-Circuit Emulation Topics. This chapter shows you how to: 
install the emulator probe into a target system, select a target 
system clock source, allow the target system to insert wait states, 
and use the features which allow you to debug target system ROM. 



Appendix A 70322/70320 Emulator Specific Command Syntax. This appendix 
describes the command syntax which is specific to the 70322/70320 
emulators. Included are: emulator configuration items, address 
syntax, display and access modes. 
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Introduction to the 70322/70320 Emulator 

Introduction The topics in this chapter include: 

■ Purpose of the emulator 

■ Features of the emulator 



Purpose of the 
Emulator 



The HP 64731 70322/70320 emulator is designed to replace the 
70322/70320 microprocessor in your target system to help you 
debug/integrate target system software and hardware. The 
emulator performs just like the processor which it replaces, but at 
the same time, it gives you information about the bus cycle 
operation of the processor. The emulator gives you control over 
target system execution and allows you to view or modify the 
contents of processor registers, target system memory, and I/O 
resources. 
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Figure 1-1 The HP 64731 A Emulator for 70322/70320 
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Features of the 

70322/70320 

Emulator 



This section introduces you to the features of the emulator. The 
chapters which follow show you how to use these features. 



Supported 
Microprocessors 



The 84 pin PLCC version of 70322/70320 microprocessor is 
supported. 



Clock Speeds 



The emulator runs with an internal clock speed of 8 MHz (system 
clock), or with target system clocks from 4-16 MHz. 



Emulation Memory 



The HP 64731 A emulator is used with one of the following 
Emulation Memory Cards. 

B HP 64726 128K byte Emulation Memory Card 
B HP 64727 5 12K byte Emulation Memory Card 

You can define up to 16 memory ranges (at 256 byte boundaries 
and at least 256 bytes in length). The monitor occupies 4K bytes 
Heaving 124K, 508K bytes of emulation memory which you may 
use. You can characterize memory ranges as emulation RAM, 
emulation ROM, target system RAM, target system ROM, or as 
guarded memory. The emulator generates an error message when 
accesses are made to guarded memory locations. You can configure 
the emulator so that writes to memory defined as ROM cause 
emulator execution to break out of target program execution. 



Analysis The analyzer supplied with the emulator, also known as the 

emulation analyzer captures emulator bus cycle information. The 
emulation analyzer captures bus cycle states synchronously with 
the emulation clock. 



Registers 
Single-Step 



You can display or modify the 70322/70320 internal register 
contents. 

You can direct the emulation processor to execute a single 
instruction or a specified number of instructions. 
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Breakpoints 



You can set up the emulator/analyzer interaction so that when the 
analyzer finds a specific state, emulator execution will break to the 
background monitor. 



You can also define software breakpoints in your program. The 
emulator uses the 70322/70320 BRK 3 instruction to provide 
software breakpoints. When you define a software breakpoint, the 
emulator places an BRK 3 instruction at the specified address; 
after the BRK 3 instruction causes emulator execution to break out 
of your program, the emulator replaces the original opcode. 

Reset Support The emulator can be reset from the emulation system under your 
control, or your target system can reset the emulation processor. 

Configurable Target You can confi gure the emulator so that it honors target system 
System Interface wa ^ re q uests when accessing emulation memory. 



Background The monitor program runs in background, the emulator mode in 
Emulation Monitor which foreground operation is suspended so that the emulation 

processor can be used for communication with the emulation 
controller. The background monitor does not occupy any processor 
address space. 



Real-Time Operation Real-time operation signifies continuous execution of your 

program without interference from the emulator. (Such 
interference occurs when the emulator temporarily breaks to the 
monitor so that it can access register contents or target system 
memory or I/O.) 

You can restrict the emulator to real-time execution. When the 
emulator is executing your program under the real-time restriction, 
commands which display/modify registers, display/modify target 
system memory or I/O, or single-step are not allowed. 
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Getting Started 



Introduction This chapter will lead you through a basic, step by step tutorial 

designed to familiarize you with the HP 64731 emulator for the 
70322/70320 microprocessor. 

This chapter will: 

■ Describe the sample program used for this chapter's 
examples. 

B Show you how to use the 'help" facility. 
B Show you how to use the memory mapper. 

■ Show you how to enter emulation commands to view 
execution of the sample program. The commands 
described in this chapter include: 

- displaying and modifying memory 

- stepping 

- displaying registers 

- defining macros 

- searching memory 

- running 

- breaking 

- using software breakpoints 

- copying memory 

- testing coverage. 
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Before You Begin Before beginning the tutorial presented in this chapter, you must 

have completed the following tasks: 

1. Completed hardware installation of the HP64700 emulator 
in the configuration you intend to use for your work: 

- Standalone configuration 

- Transparent configuration 

- Remote configuration 

- Local Area Network configuration 

References: HP 64700 Series Installation/Service manual 

2. If you are using the Remote configuration, you must have 
completed installation and configuration of a terminal 
emulator program which will allow your host to act as a 
terminal connected to the emulator. In addition, you must 
start the terminal emulator program before you can work 
the examples in this chapter. 

3. If you have properly completed steps 1 and 2 above, you 
should be able to hit < RETURN> (or < ENTER> on 
some keyboards) and get one of the following command 
prompts on your terminal screen: 

U> 
R> 
M> 

If you do not see one of these command prompts, retrace 
your steps through the hardware and software installation 
procedures outlined in the manuals above, verifying all 
connections and procedural steps. 

In any case, you must have a command prompt on your 
terminal screen before proceeding with the tutorial. 
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A Look at the Sample The sample program used in this chapter is listed in 

Program figure 2-1. The program transfers message data to another memory 
area. 



FILE: ~o/64731/sampprog HEWLETT-PACKARD: 70320 Assembler 
LOCATION OBJECT CODE LINE SOURCE LINE 







1 


"70320" 










2 




PROG 




0000 


B80000 


3 


START 


MOV 


AW, #0000H 


0003 


BB0000 


4 




MOV 


BW, OFFSET MESSAGE 


0006 


B108 


5 




MOV 


CL, 8 


0008 


8A07 


6 


LOOP 


MOV 


AL, [BW] 


000A 


88870002 


7 




MOV 


[BW+200H] , AL 


000E 


43 


8 




INC 


BW 


000F 


FEC9 


9 




DEC 


CL 


0011 


75F5 


10 




BNZ 


LOOP 


0013 


EBFE 


11 


END 


BR 


END 






12 












13 




DATA 




0000 


7550443730 


14 


MESSAGE 


ASC 


"UPD70320" 






15 












16 




COMN 




0000 


2020202020 


17 


DISPLAY 


ASC 








18 




END 





Figure 2-1 Sample Program Listing 
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Using the "help" The HP 64700 Series emulator's Terminal Interface provides an 

FaPlMtv excellent help facility to provide you with quick information on the 

^ various commands and their options. From any system prompt, 

you can enter "help" or "?" as shown below. 



help - display help information 



help <group> - print help for desired group 

help -s <group> - print short help for desired group 

help <command> - print help for desired command 

help - print this help screen 



VALID <group> NAMES 

gram - system grammar 

proc - processor specific grammar 



sys - system commands 

emul - emulation commands 

trc - analyzer trace commands 

xtrc - external trace analysis commands 

* - all command groups 



Commands are grouped into various classes. To see the commands 
grouped into a particular class, you can use the help command with 
that group. Viewing the group help information in short form will 
cause the commands or the grammar to be listed without any 
description. For example, if you want to get some information for 
group gram, enter "help gram". Following help information should 
be displayed. 



gram - system grammar 



SPECIAL CHARACTERS 

# - comment delimiter ; - command separator Ctl C - abort signal 

{} - command grouping "" - ascii string ,v - ascii string 

Ctl R - command recall Ctl B - recall backwards 

EXPRESSION EVALUATOR 

number bases : t-ten y-binary q-octal o-octal h-hex 

repetition and time counts default to decimal - all else default to hex 

operators: () -*/%+-<< <<< >>> >> & * | && 
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Help information exists for each command. Additionally, there is 
help information for each of the emulator configuration items. 



A number of prompts are used by the HP 64700 Series emulators. 
Each of them has a different meaning, and contains information 
about the status of the emulator before and after the commands 
execute. These prompts may seem cryptic at first, but there are two 
ways you can find out what a certain prompt means if you are not 
familiar with it. 

Using "help proc"to View Prompt Description 

The first way you can find information on the various system 
prompts is to look at the proc help text. 



Address format 

Memory address — 20 bit physical or 32 bit (seg:off) logical address 
10 addresses — 16 bit address 

Emulation Status Characters 

R - emulator in reset state 

U - running user program 

M - running monitor program 

W - waiting for CMB to become ready 

s - processor in stop mode 

? - unknown state 

Equates for Analyzer Label Stat 



extmemf etch 


- external mem fetch 


f irstop 


- first opecode 


extmemrd 


- external mem read 


grd 


- guarded access 


extmemwr 


- external mem write 


hldack 


- hold acknowledge 


dmaack 


- dma acknowledge 


intack 


- interrupt ack 


dmamtom 


- dma memory to memory 


iord 


- io read 


msextmemrd 


- macro serv ext mem read 


iowr 


- io write 


msextmemwr 


- macro serv ext mem write 


iramrd 


- int ram read 


msiramrd 


- macro serv int ram read 


iramwr 


- int ram write 


msiramwr 


- macro serv int ram write 


refresh 


- refresh 


msiromrd 


- macro serv int rom read 


sf rrd 


- sfr read 


mssf rrd 


- macro serv sfr read 


sf rwr 


- sfr write 


mssfrwr 


- macro serv sfr write 


wrrom 


- write to rom 


mon 


- in monitor 







Becoming Familiar 
with the System 
Prompts 



c - no target system clock 
r - target system reset active 
h - processor halted 
g - bus granted 
b - no bus cycles 
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Using the Emulation Status Command (es) for Description of 
Current Prompt 

When using the emulator, you will notice that the prompt changes 
after entering certain commands. If you are not familiar with a new 
prompt and would like information about that prompt only, enter 
the es (emulation status) command for more information about 
the status of the emulator. 

U>es 

N70322 — Running user program 



Initializing the If you plan to follow this tutorial by entering commands on your 

EmUldtCT emulator as shown in this chapter, verify that no one else is using 

the emulator. 



To initialize the emulator, enter the following command: 
R>init 

# Limited initialization completed 

The ink command with no options causes a limited initialization, 
also known as a warm start initialization. Warm start initialization 
does not affect system configuration. However, the ink command 
will reset emulator and analyzer configurations. The ink command: 



■ Resets the memory map. 

■ Resets the emulator configuration items. 
B Resets the break conditions. 

■ Clears software breakpoints. 
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The ink command does not: 



B Clear any macros. 

■ Clear any emulation memory locations; mapper terms are 
deleted, but if you respecify the mapper terms, you will 
find that the emulation memory contents are the same. 

Other Types Of There are two options to the ink command which specify other 
Initialization types of initializations. The -p option specifies a powerup 

initialization, also known as a cold start initialization. The cold 
start initialization sequence includes the emulator, analyzer, system 
controller, and communications port initialization; additionally, 
performance verification tests are run. 

The -c option also specifies a cold start initialization, except that 
performance verification tests are not run. 



ing Memory Depending on the memory board, emulation memory consists of 
128K or 512Kbytes, mappable in 256 byte blocks. The monitor 
occupies 4K bytes, leaving 124K or 508K bytes of emulation 
memory which you may use. The emulation memory system does 
not introduce wait states. 

The memory mapper allows you to characterize memory locations 
It allows you specify whether a certain range of memory is present 
in the target system or whether you will be using emulation 
memory for that address range. You can also specify whether the 
target system memory is ROM or RAM, and you can specify that 
emulation memory be treated as ROM or RAM. 
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Note tisli Target system access to emulation memory is not allowed. Target 

system devices that take control of the bus (for example, 
coprocessors or external DMA controllers) cannot access 
emulation memory. 



Blocks of memory can also be characterized as guarded memory. 

Guarded memory accesses will generate 'break to monitor" 
requests. Writes to ROM will generate 'break to monitor" requests 
if the rom break condition is enabled. Memory is mapped with the 
map command. To view the memory mapping options, enter: 

M>help map 



map - display or modify the processor memory map 

map - display the current map structure 

map <addr . . addr> <type> - define address range as memory type 

map other <type> - define all other ranges as memory type 

map -d <term#> - delete specified map term 

map -d * - delete all map terms 



-- VALID <type> OPTIONS - 

eram - emulation ram 

erom - emulation rom 

tram - target ram 

trom - target rom 

grd - guarded memory 



Enter the map command with no options to view the default map 
structure. 

M>map 



# remaining number of terms : 16 

# remaining emulation memory : lbOOOh bytes 
map other tram 
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Which Memory 
Locations Should be 
Mapped? 



Typically, assemblers generate relocatable files and linkers 
combine relocatable files to form the absolute file. The linker load 
map listing will show what memory locations your program will 
occupy in memory. A linker load map listing for the sample 
program is shown below. 



HP 64000+ Linker 

FILE/PROG NAME PROGRAM DATA COMMON ABSOLUTE 



sampprog.R 00001000 00001200 00001400 

next address 00001014 00001208 00001408 

XFER address = 00000000 Defined by DEFAULT 

Current working directory = /users/whoever/work 

Absolute file name = sampprog.X 

Total number of bytes loaded = 00000024 



From the load map listing, you can see that the sample program 
occupies three address range. The program area, which contains 
the opcodes and operands which make up the sample program, 
occupies locations 1000H through 1014H. The data area, which 
contains the ASCII values of the messages the program transfers, is 
occupies locations 1200H through 1207H. The destination area, 
which contains the command input byte and the locations of the 
message destination, occupies locations 1400H through 1407H. 

Since the program writes to the destination locations, the mapper 
block of destination area should not be characterized as ROM 
memory. Enter the following command to map memory for the 
sample program, and display the memory map. 

R>map 1000.. lOff erom 
R>map 1200.. 12ff erom 
R>map 1400.. 14ff eram 

R>map 



# remaining number of terms : 13 

# remaining emulation memory : ladOOh bytes 
map 001000 .. OOlOff erom # term 1 

map 001200 .. 0012ff erom # term 2 
map 001400 .. 0014ff eram # term 3 
other tram 
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When mapping memory for your target system programs, you may 
wish to characterize emulation memory locations containing 
programs and constants (locations which should not be written to) 
as ROM. This will prevent programs and constants from being 
written over accidentally, and will cause breaks when instructions 
or commands attempt to do so (if the rom break condition is 
enabled). 



Getting the 
Sample Program 
into Emulation 
Memory 



This section assumes you are using the emulator in one of three 
configurations: 



1. Connected only to a terminal, which is called the standalone 
configuration. In the standalone configuration, you must modify 
memory to load the sample program. 

2. Connected between a terminal and a host computer, which is 
called the transparent configuration. In the transparent 
configuration, you can load the sample program by downloading 
from the "other" port. 

3. Connected to a host computer and accessed via a terminal 
emulation program (for example, the terminal window of the PC 
Interface). Configurations in which the emulator is connected to, 
and accessed from, a host computer are called remote 
configurations. In the remote configuration, you can load the 
sample program by downloading from the same port. 



Standalone 
Configuration 



If you are operating the emulator in the standalone configuration, 
the only way to get the sample program into emulation memory is 
by modifying emulation memory locations with the m (memory 
display/modification) command. 
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You can enter the sample program into memory with the m 
command as shown below. 

R>m -db 1000=0b8, 0, 0, Obb, 0, 12, Obi, 8 
R>m -db 1008=8a, 7, 88, 87, 0, 2, 43, Ofe 
R>m -db 1010=0c9, 75, 0f5, Oeb, Ofe 
R>m -db 1200=75,50,44,37,30,33,32,30 
R>m -db 1400. .1407=20 

After entering the opcodes and operands, you would typically 
display memory in mnemonic format to verify that the values 
entered are correct (see the example below). If any errors exist, you 
can modify individual locations. Also, you can use the cp (copy 
memory) command if, for example, a byte has been left out, but the 
locations which follow are correct. 

R>m -dm 1000 . . 1013 



001000 


b80000 


MOV AW, #0000H 


001003 


bb0012 


MOV BW, #1200H 


001006 


bl08 


MOV CL, #08H 


001008 


8a07 


MOV AL, BYTE PTR [BW] 


00100a 


88870002 


MOV BYTE PTR 200H[BW],AL 


001003 


43 


INC BW 


OOlOOf 


fec9 


DEC CL 


001011 


75f 5 


BNE 1008H 


001013 


ebf e 


BR 1013H 



Note Be careful about using this method to enter programs from the 

listings of relocatable source files. If source files appear in 
relocatable sections, the address values of references to locations in 




other relocatable sections are not resolved until link-time. The 
correct values of these address operands will not appear in the 
assembler listing. 
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Transparent 
Configuration 



If your emulator is connected between a terminal and a host 
computer, you can download programs into memory using the load 
command with the -o (from other port) option. The load command 
will accept absolute files in the following formats: 



B HP absolute. 



■ Intel hexadecimal. 

■ Tektronix hexadecimal. 

B Motorola S-records. 

The examples which follow will show you the methods used to 
download HP absolute files and the other types of absolute files. 



HP Absolutes 

Downloading HP format absolute files requires the 
transfer protocol. The example below assumes that the transfer 
utility has been installed on the host computer (HP 64884 for HP 
9000 Series 500, or HP 64885 for HP 9000 Series 300). 



4 



Note HS& Notice that the transfer command on the host computer is 

terminated with the < ESCAPE> g characters; by default, these are 
the characters which temporarily suspend the transparent mode to 
allow the emulator to receive data or commands. 



R>load -hbo <RETURN> <RETURN> 

$ transfer -rtb sampprog.X <ESCAPE>g 



### 

R> 
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Other Supported Absolute Files 



The example which follows shows how to download Intel 
hexadecimal files, but the same method (and a different load 
option) can be used to load Tektronix hexadecimal and Motorola 
S-record files as well. 

R>load -io <RETURN> <RETURN> 
$ cat ihexfile <ESCAPE>g 

##### 

Data records = 00003 Checksum error = 00000 
R> 



Remote Configuration If the emulator is connected to a host computer, and you are 

accessing the emulator from the host computer via a terminal 
emulation program, you can also download files with the load 
command. However, in the remote configuration, files are loaded 
from the same port that commands are entered from. For example, 
if you wish to download a Tektronix hexadecimal file from a Vectra 
personal computer, you would enter the following commands. 

R>load -t <RETURN> 

After you have entered the load command, exit from the terminal 
emulation program to the MS-DOS operating system. Then, copy 
your hexadecimal file to the port connected to the emulator, for 
example: 

C:\copy thexfile coml : <RETURN> 

Now you can return to the terminal emulation program and verify 
that the file was loaded. 



For More Information For more information on downloading absolute files, refer to the 

load command description in the HP 64700 Emulators Terminal 
Interface: User's Reference manual. 
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Once you have loaded a program into the emulator, you can verify 
that the program has indeed been loaded by displaying memory in 
mnemonic format. 



R>m -dm 1000 . . 1013 



001000 


b80000 


MOV AW, #0000H 


001003 


bb0012 


MOV BW, #1200H 


001006 


bl08 


MOV CL, #08H 


001008 


8a07 


MOV AL, BYTE PTR [BW] 


00100a 


88870002 


MOV BYTE PTR 200H[BW],AL 


001003 


43 


INC BW 


OOlOOf 


fec9 


DEC CL 


001011 


75f 5 


BNE 1008H 


001013 


ebf e 


BR 1013H 



If you display memory in mnemonic format and do not recognize 
the instructions listed or see some illegal instructions or opcodes, 
go back and make sure the memory locations you are trying to 
display have been mapped. If the memory map is not the problem, 
recheck the linker load map listing to verify that the absolute 
addresses of the program agree with the locations you are trying to 
display. 



Displaying 
Memory In 
Mnemonic Format 
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Stepping Through The emulator allows you to execute one instruction or a number of 
the PrOQT3m instructions with the s (step) command. Enter the help s to view 

the options available with the step command. 

R>help s 



- step emulation processor 

s - step one from current PC 

s <count> - step from current PC 

s <count> $ - step from current PC 

s <count> <addr> - step from addr 

s -q <count> <addr> - step from addr, quiet mode 

s -w <count> <addr> - step from addr, whisper mode 

-- NOTES 

STEPCOUNT MUST BE SPECIFIED IF ADDRESS IS SPECIFIED! 

If <addr> is not specified, default is to step from current PC. 

A <count> of 0 implies step forever. 



A step count of 0 will cause the stepping to continue "forever" 
(until some break condition, such as "write to ROM", is 
encountered, or until you enter < CTRL> c). The following 
command will step from the first address of the sample program. 

R>s 1 0:1000 

00000:01000 b80000 MOV AX, #0000H 

PC = 00000:01003 



Displaying The step command shown above executed a MOV AW,# 0 

Rpni^tPI*^ instruction. Enter the following command to view the contents of 

** the registers. 

M>reg 

reg ps=0000 pc=1003 psw=f002 aw=0000 bw=0bf8 cw=0000 dw=0000 sp=07f8 bp=0014 
reg ix=00f0 iy=0000 ds0=0000 dsl=0000 ss=0000 
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The register contents are displayed in a "register modify" command 
format. This allows you to save the output of the reg command to a 
command file which may later be used to restore the register 
contents. (Refer to the po (port options) command description in 
the Terminal Interface: User's Reference for more information on 
command files.) 

You can also display peripheral control block registers or certain 
classes of peripheral registers. Refer to the "70322/70320 Emulator 
Specific Command Syntax" appendix for more information on the 
peripheral register names and classes. 



Combining More than one command maybe entered in a single command line 
Commands ^ trie commands are separated by semicolons (;). For example, you 

could execute the next instruction(s) and display the registers by 

entering the following. 

M>s; reg 



00000:01003 bb0012 MOVBW,#1200H 
PC = 00000:01006 

reg ps=0000 pc=1006 psw=f002 aw=0000 bw=1200 cw=0000 dw=0000 sp=07f8 bp=0014 
reg ix=00f0 iy=0000 ds0=0000 dsl=0000 ss=0000 
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Using Macros Suppose you want to continue stepping through the program, 

displaying registers after each step. You could continue entering s 
commands followed byreg commands, but you may find this 
tiresome. It is easier to use a macro to perform a sequence of 
commands which will be entered again and again. 

Macros allow you to combine and store commands. For example, 
to define a macro which will display registers after every step, enter 
the following command. 

M>mac st={s;reg} 

Once the st macro has been defined, you can use it as you would 
any other command. 

M>st 



# s;reg 

00000:01006 bl08 MOV CL, #08H 

PC = 0000:01008 

reg ps=0000 pc=1008 psw=f002 aw=0000 bw=1200 cw=0008 dw=0000 sp=07f8 bp=0014 
reg ix=00f0 iy=0000 ds0=0000 dsl=0000 ss=0000 



Command Recall The command recall feature is yet another, easier way to enter 

commands again and again. You can press < CTRL> r to recall the 
commands which have just been entered. If you go past the 
command of interest, you can press < CTRL> b to move forward 
through the list of saved commands. To continue stepping through 
the sample program, you could repeatedly press < CTRL> r to 
recall and < RETURN> to execute the st macro. 



Repeating Commands The rep command is also helpful when entering commands 

repetitively. You can repeat the execution of macros as well 
commands. For example, you could enter the following command 
to cause the st macro to be executed four times. 

M>rep 4 st 
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# s;reg 

00000:01008 8a07 MOV AL, BYTE PTR [BW] 

PC = 00000:0100a 

reg ps=0000 pc=100a psw=f002 aw=0075 bw=1200 cw=0008 dw=0000 sp=07f8 bp=0014 
reg ix=00f0 iy=0000 ds0=0000 dsl=0000 ss=0000 

# s;reg 

00000:0100a 88870002 MOV BYTE PTR 0200H [BW] , AL 
PC = 00000:0100e 

reg ps=0000 pc=100e psw=f002 aw=0075 bw=1200 cw=0008 dw=0000 sp=07f8 bp=0014 
reg ix=00f0 iy=0000 ds0=0000 dsl=0000 ss=0000 

# s;reg 

00000:0100e 43 INC BW 

PC = 00000:0100f 

reg ps=0000 pc=100f psw=f002 aw=0075 bw=1201 cw=0008 dw=0000 sp=07f8 bp=0014 
reg ix=00f0 iy=0000 ds0=0000 dsl=0000 ss=0000 

# s;reg 

00000:0100f fec9 DEC CL 

PC = 00000:01011 

reg ps=0000 pc=1011 psw=f002 aw=0075 bw=1201 cw=0007 dw=0000 sp=07f8 bp=0014 
reg ix=00f0 iy=0000 ds0=0000 dsl=0000 ss=0000 



The preceding step and register commands show the sample 
program is executing transfer message data to destination area. Use 
the m (memory) command to modify the source message data bytes. 

M>m 1200=41,42,43,44,45,46,47,48 

To verify that above data has been written to 1200H, enter the 
following command. 

M>m -db 1200. .1207 

001200 .. 001207 41 42 43 44 45 46 47 48 

When memory was displayed in byte format earlier, the display 
mode was changed to 'byte". The display and access modes from 
previous commands are saved and they become the defaults. 

There are a couple different ways to modify the display and access 
modes. One is to explicitly specify the mode with the command you 
are entering (e.g., m -db 1200). The mo (display and access mode) 
command is another way to change the default mode. For example, 
to display the current modes, define the display mode as "word", 
and redisplay 1200H, enter the following commands. 

M>mo 

mo -ab -db 



Modifying Memory 



Specifying the 
Access and Display 
Modes 
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M>mo -dw 
M>m 1200 



001200 .. 001200 4241 

To continue the rest of program .. 



M>r 



Display the DISPLAY memory locations (destination of the 
message, 1400H) to verify that the program moved the correct 
ASCII bytes. At this time we want to see correct byte value, so 
"-db" option (display with byte) is used. 

M>m -db 1400 . . 1407 



001400 .. 001407 41 42 43 44 45 46 47 48 



Searching The ser (search memory for data) command is another way to 

Memory for Data 



verify that the program did what it was supposed to do. 



M>ser 1200 . . 1207="FG 

pattern match at address: 001205 



If any part of the data specified in the ser command is not found, 
no match is displayed (No message displayed). 
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Breaking into the 
Monitor 



You can use the break command (b) command to generate a break 
to the background monitor. While the break will occur as soon as 
possible, the actual stopping point maybe many cycles after the 
break request (depend on the type of instruction being executed 
and whether the processor is in a hold state). 

U>b 

M> 



4 



Note Ma If DMA transfer is in progress with BURST transfer mode, the 

emulator can break into monitor after such DMA transfers are 
completed. 



Using Software 
Breakpoints 



Software breakpoints are handled by the 70322/70320 BRK 3 
instruction. When you define or enable a software breakpoint 
(with the bp command), the emulator will replace the opcode at 
the software breakpoint address with a breakpoint interrupt 
instruction (BRK 3). 



4 



Note WA Y° u must only set software breakpoints at memory locations which 

contain instruction opcodes (not operands or data). If a software 
breakpoint is set at a memory location which is not an instruction 
opcode, the software breakpoint instruction will never be executed 
and the break will never occur. 
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Software breakpoints should not be set, enabled, disabled, or 
removed while the emulator is running user code. If any of these 
commands are entered while the emulator is running user code, 
and the emulator is executing code in the area where the 
breakpoint is being modified, program execution maybe unreliable. 



Because software breakpoints are implemented by replacing 
opcodes with the BRK 3 instructions, you cannot define software 
breakpoints in target ROM. You can, however, copy target ROM 
into emulation memory (see the "Target ROM Debug Topics" 
section of the "In-Circuit Emulation" chapter). 



When the emulator detects a vector fetch from the BRK 3 
interrupt vector area (in other words, the BRK 3 instruction has 
executed or vector area is read from user program), it generates a 
break to background request. Since the system controller knows 
the locations of defined software breakpoints, it can determine 
whether the BRK 3 interrupt was generated by an enabled software 
breakpoint or by a BRK 3 interrupt instruction in your target 
program. 

If the BRK 3 interrupt was generated by a software breakpoint, 
execution breaks to the monitor, and the breakpoint interrupt 
instruction (BRK 3) is replaced by the original opcode. A 
subsequent run or step command will execute from this address. 

If the BRK 3 interrupt was generated by a BRK 3 interrupt 
instruction in the target system, execution still breaks to the 
monitor, and an "undefined breakpoint" status message is 
displayed. To continue with program execution, you must run or 
step from the target program's breakpoint interrupt vector address. 



Getting Started 2-21 



Displaying and 
Modifying the Break 
Conditions 



be -d bp tdisable 
be -e rom tenable 
be -d bnct #disable 
be -d cmbt tdisable 
be -d trigl tdisable 
be -d trig2 tdisable 



Before you can define software breakpoints, you must enable 
software breakpoints with the be (break conditions) command. To 
view the default break conditions and change the software 
breakpoint condition, enter the be command with no option. This 
command displays current configuration of break conditions. 

M>bc 



To enable the software break point feature enter 
M>bc -e bp 



Defining a Software 
Breakpoint 



bp 001008 tenabled 



Now that the software breakpoint feature is enabled, you can 
define software breakpoints. Enter the following command to 
break on the address of the LOOP (address 1000H) label. 

M>bp 1000 
M>bp 

Run the program, and verify that execution broke at the 
appropriate address. 

M>r 0:1000 



! ASYNC_STAT 615! Software breakpoint: 00000:01008 

M>st 



MOV AL, BYTE PRT [BW]R 



t s;reg 

00000:0100a 8a07 
PC = 00000:0100a 

reg ps=0000 pc=100a psw=f686 aw=0041 bw=1200 cw=0008 dw=9f65 sp=38bb bp=28e£ 
reg ix=00fl iy=8577 ds0=0000 dsl=0000 ss=0000 
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When a breakpoint is hit, it becomes disabled. You can use the 
-e option to the bp command to re-enable the software breakpoint. 

M>bp 

### BREAKPOINT FEATURE IS ENABLED ### 
bp 001008 #disabled 

M>bp -e 001008 
M>bp 

### BREAKPOINT FEATURE IS ENABLED ### 
bp 001008 #enabled 

M>r 1000 

!ASYNC_STAT 615! Software breakpoint: 00000:01008 

M>bp 

### BREAKPOINT FEATURE IS ENABLED ### 
bp 001008 #disabled 



Using the Analyzer 

Predefined Trace Three trace labels are predefined in the 70322/70320 emulator. 
Labels You can view these labels by entering the tlb (trace label) 
command with no options. 

M>tlb 

#### Emulation trace labels 
tlb addr 0 . . 19 
tlb data 20 . . 35 
tlb stat 36. .46 
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Predefined StatUS Common values for the 70322/70320 status trace signals have been 
Equates predefined. You can view these predefined equates by entering the 
equ command with no options. 

M>equ 

### Equates ### 
equ dmaack=0xxx0xxxxxxxy 
equ dmamtom=0xxxxx011011y 
equ extmemfetch=0xxxxx001001y 
equ extmemrd=0xxxxx001011y 
equ extmemwr=0xxxxx001101y 
equ f irstop=0xxxxxxxxxxx0y 
equ grd=0x0xxxxxxxxxy 
equ hldack=0xxxx0xxxxxxy 
equ intack=0xxxxx000001y 
equ iord=0xxxxx000011y 
equ iowr=0xxxxx000101y 
equ iramrd=0xxxxxll0001y 
equ iramwr=0xxxxxll0101y 
equ iromrd=0xxxxx010001y 
equ mon=Oxxxxxxxxxxy 
equ msextmemrd=0xxxxxl01001y 
equ msextmemwr=0xxxxxl01101y 
equ msiramrd=0xxxxxl00001y 
equ msiramwr=0xxxxxl00101y 
equ msiromrd=0xxxxx010011y 
equ mssf rrd=0xxxxxl00011y 
equ mssf rwr=0xxxxxl00111y 
equ ref resh=0xxxxx010101y 
equ sf rrd=0xxxxxll0011y 
equ sf rwr=0xxxxxll0111y 
equ wrrom=0xx0xxxxxxxxy 

These equates maybe used to specify values for the stat trace label 
when qualifying trace conditions. 

The tg analyzer command is a simple way to specify a condition on 
which to trigger the analyzer. Suppose you wish to trace the states 
of the program after the read of a "E" (45H) ascii data from the 
source data area. Enter the following commands to set up the 
trace, run the program, issue the trace, and display the trace status. 
(Note that the analyzer is to search for a lower byte read of 45H 
because the address is even.) 



Specifying a Simple 
Trigger 
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M>tg data=0xx45 
M>t 

M>r 0:1000 

Emulation trace started 

U>tS 

Emulation Trace Status 

NEW User trace complete 

Arm ignored 

Trigger in memory 

Arm to trigger ? 

States 396 (396) -140.. 255 

Sequence term 2 

Occurrence left 1 



The trace status now shows that the trigger condition has been 
found, and that 396 states have been stored in trace memory. Enter 
the following command to display the first 20 states of the trace. 

U>tl -t 20 



Line 


addr, H 


7032x mnemonic, H 




xbits, H 


count , R 


0 


01204 


45H, 


mem read 


(ext) 


0000 








1 


00089 


45xxH, 


refresh 




0000 


0 


. 960 


uS 


2 


0100a 


INSTRUCTION- 


-opcode unavailable 


0000 


0 


.280 


uS 


3 


OlOOe 


43H, 


fetch 


(ext) 


0000 


2 


.760 


uS 


4 


OlOOf 


fexxH, 


fetch 


(ext) 


0000 


2 


. 000 


uS 


5 


01010 


c9H, 


fetch 


(ext) 


0000 


2 


. 000 


uS 


6 


0008a 


c9H, 


refresh 




0000 


0 


. 960 


uS 


7 


OlOOe 


INC BW 






0000 


2 


.280 


uS 


8 


01404 


45H, 


mem write 


(ext) 


0000 


0 


.760 


uS 


9 


OlOOf 


DEC CL 






0000 


1 


.240 


uS 


10 


01011 


75xxH, 


fetch 


(ext) 


0000 


0 


.760 


uS 


11 


01012 


f 5H, 


fetch 


(ext) 


0000 


2 


.000 


uS 


12 


0008b 


f 5xxH, 


refresh 




0000 


0 


. 960 


uS 


13 


01011 


BNE 1008H 






0000 


2 


.280 


uS 


14 


01013 


ebxxH, 


fetch 


(ext) 


0000 


0 


.760 


uS 


15 


01014 


feH, 


fetch 


(ext) 


0000 


2 


. 000 


uS 


16 


01015 


OOxxH, 


fetch 


(ext) 


0000 


2 


. 000 


uS 


17 


0008c 


00H, 


refresh 




0000 


0 


. 960 


uS 


18 


01016 


00H, 


fetch 


(ext) 


0000 


3 


.040 


uS 


19 


01017 


OOxxH, 


fetch 


(ext) 


0000 


2 


.000 


uS 



Line 0 in the trace list above shows the state which triggered the 
analyzer. The trigger state is always on line 0. To list the next lines 
of the trace, enter the following command. 
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U>tl 



Line 


addr H 


7032x mnemonic, H 




aiji Lo j n 




count, R seq 


20 


0008H 


OOxxH, 


refresh 




0000 




960 


uS 


2 1 


01008 


8aH, 


fetch 


( ext ) 


0000 


3 


040 


uS 


22 


01009 


07xxH, 


fetch 


(ext ) 


0000 


2 


000 


uS 


23 


0100a 


88H, 


fetch 


(ext) 


0000 


2 


000 


uS 


24 


0008e 


88H, 


refresh 




0000 


0 


960 


uS 


25 


01008 


MOV AL, BYTE 


PTR [BW] 




0000 


0 


280 


uS 


26 


0100b 


87xxH, 


fetch 


(ext) 


0000 


2 


760 


uS 


27 


0100c 


00H, 


fetch 


(ext) 


0000 


2 


000 


uS 


28 


OlOOd 


02xxH, 


fetch 


(ext) 


0000 


2 


000 


uS 


29 


0008f 


02xxH, 


refresh 




0000 


0 


960 


uS 


30 


01205 


46xxH, 


mem read 


(ext) 


0000 


3 


040 


uS 


31 


0100a 


MOV BYTE PTR 


0200H [BW] 


AL 


0000 


1 


240 


uS 


32 


OlOOe 


43H, 


fetch 


(ext) 


0000 


0 


760 


uS 


33 


OlOOf 


f exxH, 


fetch 


(ext) 


0000 


2 


000 


uS 


34 


00090 


feH, 


refresh 




0000 


0 


960 


uS 


35 


01010 


c9H, 


fetch 


(ext) 


0000 


3 


040 


uS 


36 


OlOOe 


INC BW 






0000 


1 


240 


uS 


37 


01405 


46xxH, 


mem write 


(ext) 


0000 


0 


760 


uS 


38 


OlOOf 


DEC CL 






0000 


1 


240 


uS 


39 


01011 


75xxH, 


fetch 


(ext) 


0000 


0 


760 


uS 



For a Complete For a complete description of the HP 64700 Series analyzer, refer 
Description to tne HP 64700 Emulators Terminal Interface: Analyzer User's 



Guide. 
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Copying Memory The cp (copy memory) command gives you the ability to copy the 

contents of one range of memory to another. This is a handy 
feature to test things like the relocatability of programs, etc. This 
also useful to save result of data to another locations. To save 
transfered data to another memory area. 

U>cp 1420=1400. .1407 
U>m 1420. .1427 

001420 .. 001427 41 42 43 44 45 46 47 48 



Testing for For each byte of emulation memory, there is an additional bit of 

PoVPraflP emulation RAM used by the emulator to provide coverage testing. 

** When the emulator is executing the target program and an access is 

made to a byte in emulation memory, the corresponding bit of 
coverage memory is set. With the cov command, you can see which 
bytes in a range of emulation memory have (or have not) been 
accessed. 

For example, suppose you want to determine how extensive some 
test input is in exercising a program (in other words, how much of 
the program is covered by using the test input). You can run the 
program with the test input and then use the cov command to 
display which locations in the program range were accessed. 

The examples which follow use the cov command to perform 
coverage testing on the sample program. Before performing 
coverage tests, reset all coverage bits to non-accessed by entering 
the following command. 

U>cov -r 
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Set software breakpoint at 1008 (as in earlier), and run the 
program from the start address (00000:01000H) and use the cov 
command to display how much of the program is accessed. 

U>rst 
R>cov -r 
R>bp -e 1008 
R>r 1000 



!ASYNC_STAT 615! Software breakpoint: 00000:01008 

M>cov -a 1000.. 1014 

# coverage list - list of address ranges accessed 
001000. .00100d 

percentage of memory accessed: % 66.6 

Now run the rest of programs. 
M>r 

U>cov -a 1000 . . 1014 

# coverage list - list of address ranges accessed 
001000. .001014 

percentage of memory accessed: % 100.0 



RGSGttiflQ tll6 To reset the emulator, enter the following command. 

Emulator 

U>rst 

R> 

The emulator is held in a reset state (suspended) until a b (break), 
r (run), or s (step) command is entered. A CMB execute signal will 
also cause the emulator to run if reset. 

The -m option to the rst command specifies that the emulator 
begin executing in the monitor after reset instead of remaining in 
the suspended state. 

R>rst -m 

M> 



2-28 Getting Started 



3 



Emulation Topics 



Introduction Many of the topics described in this chapter involve the commands 

which are unique to the 70322/70320 emulator such as the cf 
command which allows you to specify emulator configuration. A 
reference-type description of the 70322/70320 emulator 
configuration items can be found in the '70322/70320 Emulator 
Specific Command Syntax" appendix. 

This chapter will: 

■ Describe how to run in real-time, how to specify the 
default interpretation of physical run addresses, and how 
to break on an analyzer trigger. These topics are related to 
program execution in general. 

B Describe how to locate the monitor, These topics are 
related to the monitor options. 

B Describe how to do other things which do not fall into the 
categories mentioned above: how to specify a run from 
reset. 
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Pr6T6C|UiSit6S Before performing the tasks described in this chapter, you should 

be familiar with how the emulator operates in general. Refer to the 
Concepts of Emulation and Analysis manual and the "Getting 
Started" chapter of this manual. 



Execution Topics 



The descriptions in this section are of emulation tasks which 
involve program execution in general. 



Restricting the 
Emulator to 
Real-Time Runs 



By default, the emulator is not restricted to real-time runs. 
However, you may wish to restrict runs to real-time to prevent 
accidental breaks that might cause target system problems. Use the 
cf (configuration) command to enable the rrt configuration item. 

R>cf rrt=en 

When runs are restricted to real-time and the emulator is running 
user code, the system refuses all commands that cause a break 
except rst (reset), r (run), and b (break to monitor). 

Because the emulator contains dual-port emulation memory, 
commands which access emulation memory are allowed while runs 
are restricted to real-time. 
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The following commands are not allowed when runs are restricted 
to real-time: 



Default Physical to 
Logical Run Address 
Conversion 



B reg (register display/modification). 

■ m (memory display/modification) commands that access 
target system memory. 

■ io (I/O display/modification). 

■ s(step). 

The following command will disable the restriction to real-time 
runs and allow the system to accept commands normally. 

R>cf rrt=dis 

The run and step commands allow you to enter addresses in either 
logical form (segment:offset, e.g., 0F000:0FFFF) or physical form 
(e.g., OFFFFF). 

When a physical address (non-segmented) is entered with either a 
run or step command, the emulator must convert it to a logical 
( segment :offset) address. By default, a physical run address is 
converted such that the low 16 bits of the address become the offset 
value. Use the cf (configuration) command with the rad (run 
address default conversion) configuration item to specify that the 
low 4 bits of the physical address become the offset. The physical 
address is right-shifted 4 bits to yield the segment value. 

R>cf rad=maxseg 

# phys_addr = 

(phys_addr > > 4) :(phys_addr & Oxf) 

To reconfigure so that the low 16 bits of the physical address 
become the offset value, enter the following command. The 
physical address is right-shifted 4 bits and ANDed with 0F000H to 
yield the segment value. 

R>cf rad=minseg 

# phys_addr = 

((phys_addr > > 4) & Oxfl)00):(phys_addr &0xffff) 
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If you use logical addresses other than the two methods shown 
above, you must enter run and step addresses in logical form. 



Setting Up to Break 
on an Analyzer 
Trigger 



The analyzer may generate a break request to the emulation 
processor. To set up to break on an analyzer trigger, follow the 
steps below. 



Specify the Signal Driven when Trigger is Found 

Use the tgout (trigger output) command to specify which signal is 
driven when the analyzer triggers. Either the "trigl" or the "trig2" 
signal can be driven on the trigger. 

R>tgout trigl 

Enable the Break Condition 

Enable the "trigl" break condition. 
R>bc -e trigl 

After you specify the trigger to drive "trigl" and enable the "trigl" 
break condition, set up the trace, issue the t (trace) command, and 
run the program. 



Making Coordinated Coordinated measurements are measurements made between 

Measurements multiple HP 64700 Series emulators which communicate via the 
Coordinated Measurement Bus (CMB). Coordinated 
measurements can also include other instruments which 
communicate via the BNC connector. A trigger signal from the 
CMB or BNC can break emulator execution into the monitor, or it 
can arm the analyzer. An analyzer can send a signal out on the 
CMB or BNC when it is triggered. The emulator can send an 
EXECUTE signal out on the CMB when you enter the x (execute) 
command. 
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Coordinated measurements can be used to start or stop multiple 
emulators, start multiple trace measurements, or to arm multiple 
analyzers. 

As with the analyzer generated break, breaks to the monitor on 
CMB or BNC trigger signals are interpreted as a "request to break". 
The emulator looks at the state of the CMB READY (active high) 
line to determine if it should break. It does not interact with the 
EXECUTE (active low) or TRIGGER (active low) signals. 

For information on how to make coordinated measurements, refer 
to the HP 64700 Emulators Terminal Interface: Coordinated 
Measurement Bus User's Guide manual. 



Monitor Option The monitor is a program which is executed by the emulation 

TnniPQ processor. It allows the emulation system controller to access 

" target system resources. For example, when you enter a command 

that requires access to target system resources (display target 
memory, for example), the system controller writes a command 
code to a communications area and breaks the execution of the 
emulation processor into the monitor. The monitor program then 
reads the command from the communications area and executes 
the processor instructions which access the target system. After the 
monitor has performed its task, execution returns to the target 
program. 

It does not take up any processor address space and does not need 
to be linked to the target program. The monitor resides in 
dedicated background memory. 
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Background Monitor 



Some things to be aware of when using the background monitor 
are: 



B Guarded memory accesses can occur if no vector table is 
loaded and the vector table area, 0-3FFH, is mapped as 
"guarded memory". (If locations 0-3FFH are not mapped, 
the "map other grd" command specifies these locations as 
guarded memory.) 

■ Halt instructions will cause "processor halted" emulation 
status (the "h> "prompt is shown). A subsequent break 
command, followed by a run or step command, causes the 
halt instruction to be executed again. 

Locating the Monitor The default emulator configuration locates the monitor at 

000000H . You can relocate the monitor to any 4K byte boundary. 
The location of the background monitor maybe important since 
background cycles are always visible to the target system. Use the 
cf (configuration) command with the loc configuration item to 
specify the location of the monitor. 

R>cf loc=20000 

Any valid physical address maybe specified when relocating the 
monitor; however, the monitor address range will be placed on the 
4K byte boundary at or below the address specified (for example, 
the monitor is placed at 20000H after the command shown above). 



Note 




Relocating the monitor causes all memory mapper terms to be 
removed. 
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Selecting The HP 64731 70322/70320 emulator have capability to emulate 
Microprocessor 70320 (ROMless version) microprocessor and 70322 (incorporates 
internal ROM) microprocessor. You can select either 
microprocessor. To select 70320 microprocessor. 

R>cf proc=70320 
Upon power up, 70322 microprocessor is selected. 



Note 




Changing microprocessor cause all memory mapper terms to be 
removed. 



Selecting Accept Or 
Ignore Target System 
Reset 



Note 
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The 70322/70320 emulator can respond or ingore target system 
reset. You can ignore reset from target system completely by 
specifmg "cf urst= dis". In this configuration emulator ignore any 
reset from target system. Specifying "cf urst= en", this is a default 
configuration, make the emulator to respond to reset from target 
system. In this configuration, emulator will accept reset and 
execute from reset vector (0FFFF0H) as same manner as actual 
microprocessor after reset is inactivated 



This configuration item is true while either running in user 
program or running in monitor program. If enabled by entering "cf 
urst= en", emulator will respond to target system reset while 
running in monitor program. 
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Other Topics 



This section describes how other emulation tasks, which did not fit 
into the previous groupings, are performed. 



Detecting Illegal 
Opcodes 



Illegal opcode detection is handled by the processor's own 
detection mechanism. An illegal opcode interrupt will cause 
execution to be diverted to the address contained in the interrupt 
vector table. This address should point to your interrupt service 
routine. 

You must prepare illegal opcode interrupt service routine in your 
program. 



Note 




You should prepare illegal opcode interrupt service routine in your 
program code and set appropriate vector. 
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In-Circuit Emulation Topics 



Introduction Many of the topics described in this chapter involve the commands 

which relate to using the emulator in-circuit, that is, connected to a 
target system. 

This chapter will: 

■ Describe the issues concerning the installation of the 
emulator probe into target systems. 

■ Show you how to install the emulator probe. 

B Describe how to set up the emulator to use a target system 
clock and how to allow DMA accesses to emulation 
memory. How you can relocate background monitor 
program. These topics are related to program execution in 
general. 

■ Describe how to use software breakpoints with ROMed 
code, how to perform coverage testing on ROMed code, 
and how to test patches to ROMed code. These topics 
relate to the debugging of target system ROM. 

■ Describe the ACcharacteristics and the target system 
interface 

B Describe some of restrictions and considerations. 
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Pr6T6C|UiSit6S Before performing the tasks described in this chapter, you should 

be familiar with how the emulator operates in general. Refer to the 
Concepts of Emulation and Analysis manual and the "Getting 
Started" chapter of this manual. 



Installing the 
Emulator Probe 
into a Target 
System 



The emulator probe has a PLCC connector. The emulator probe is 
also provided with a non-conductive pin protector to protect the 
delicate gold-plated pins of the probe connector from damage due 
to impact. Since the protector is non-conductive, you may run 
performance verification with no adverse effects when the 
emulator is out-of-circuit. 



Caution mm Protect against static discharge. The emulation probe contains 

devices that are susceptible to damage by static discharge. 
Therefore, precautionary measures should be taken before 
handling the microprocessor connector attached to the end of the 
probe cable to avoid damaging the internal components of the 
probe by static electricity. 



Caution fmi Make sure target system power is OFF. Do not install the 

emulator probe into the target system microprocessor socket with 
power applied to the target system. The emulator maybe damaged 
if target system power is not removed before probe installation. 



4-2 In-Circuit Emulation 



Caution 




Make sure pin 1 of probe connector is aligned with pin 1 of the 
socket. When installing the emulation probe, be sure that the 



probe is inserted into the processor socket so that pin 1 of the 
connector aligns with pin 1 of the socket. Damage to the emulator 
probe will result if the probe is incorrectly installed. 



Caution 




Protect your target system CMOS components. If you target 
system contains any CMOS components, turn ON the target 



system first, then turn ON the emulator. Likewise, turn OFF your 
emulator first, then turn OFF the target system. 



PROBE CRBLE 




MICROPROCESSOR 
CONNECTOR 



PIN 1 OP 

MICROPROCPSSOR 

CONNECTOR 



PIN 1 OP 
TRRGPT 5YSTPM 
MICROPROCPSSOR 
SOCKET 



Figure 4-1 Installing into a 70322 PLCC type socket 
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Execution Topics 



The descriptions in this section are of emulation tasks which 
involve program execution in general. 



Specifying the 
Emulator Clock 
Source 



The default emulator configuration selects the internal 8 MHz 
(system clock speed) clock as the emulator clock source. You can 
configure the emulator to select an external target system clock 
source in the range of 4-16 MHz. You can use external clock or 
crystal to generate system clock as actual microprocessor does. Use 
the cf (configuration) command and the elk configuration item to 
specify that the emulator use a target system clock. 

R>cf clk=ext 

To reconfigure the emulator to use its internal clock oscillator, 
enter the following command. 

R>cf clk=int 



DMA Cycles Cycles from the emulation processor's internal DMA controller is 
allowed to access emulation memory. If DMA controller is 
programmed to transfer with Burst mode, the emulator can not 
break in monitor until transfers are completed. With other DMA 
mode, emulator breaks into the monitor (background) upon 
request, however, DMA transfers are continued. DMA cycles are 
sent to the analyzer. 



4 



Note HSa Target system DMA controller access to emulation memory is not 
allowed. Only internal DMA controller can access emulation 
memory as it's transfer object. 
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Note list External (target system) DMA controller execution cycles can be 
traced when following conditions are met. 

A. Address and data signals can be read by the emulator. In other 
words, those signals must reach to emulator probe and timing 
specification comply with specification of DMA cycles of 
70322/70320 microprocessor. 

B. Control signals (such as /MREQ , R /W, etc) can be read by the 
emulator. 



Monitor Operation The 70322/70320 emulator is background type emulator, so that 

any memory space is not required to perform emulator functions. 
However, the emulator performs some functions (such as 
display/modify target system memory) by executing monitor 
program. It is very important to know where the monitor program 
is running, since the monitor operation is always visible to target 
system. Upon power up, the background monitor resides address 
range 00000H through 00FFFH. Since the monitor operation is 
always visible to target system, if your target system have memory 
or some memory mapped I/O devices on the area, it maybe 
problem. In such case, you can relocate monitor program address 
to another location if desired. You can relocate each 4K byte 
boundary. 

To see default monitor operation address ... 
TYPE: tck-ub 

This allow the emulation analyzer to trace monitor operation 
including your program operation. 

Now, trace the monitor operation by entering "t" (trace) command 
and display analysis trace by entering "tl" (trace list display) 
command. 
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The monitor program reside 00000H through OOFFFH memory 
space. 

Now, let's relocate monitor location to 20000H by issuing 
"cf loc= 20000". And trace monitor operation as did earlier. 
Analysis trace display should resemble: 

seq 



Line 


addr, H 


7032x mnemonic, H 






xbits, H 


count, R 


0 


0011a 


00H, 


refresh 




MON 


0000 








1 


20326 


2eH, 


fetch 


(ext) 


MON 


0000 


3 


.000 


US 


2 


20327 


81xxH, 


fetch 


(ext) 


MON 


0000 


2 


.000 


uS 


3 


20328 


3eH, 


fetch 


(ext) 


MON 


0000 


2 


.000 


uS 


4 


0011b 


3exxH, 


refresh 




MON 


0000 


1 


.000 


uS 


5 


20326 


CMP PS: WORD 


PTR 00c4H 


, #0100H 




0000 


0 


.280 


uS 


6 


20327 










0000 


2 


. 000 


uS 


7 


20329 


c4xxH, 


fetch 


(ext) 


MON 


0000 


0 


. 720 


uS 


8 


2032a 


00H, 


fetch 


(ext) 


MON 


0000 


2 


. 000 


uS 


9 


2032b 


OOxxH, 


fetch 


(ext) 


MON 


0000 


2 


. 000 


uS 


10 


0011c 


00H, 


refresh 




MON 


0000 


1 


.000 


uS 


11 


2032c 


01H, 


fetch 


(ext) 


MON 


0000 


3 


.000 


uS 


12 


2032d 


74xxH, 


fetch 


(ext) 


MON 


0000 


2 


.000 


uS 


13 


2032e 


02H, 


fetch 


(ext) 


MON 


0000 


2 


.000 


uS 


14 


OOlld 


02xxH, 


refresh 




MON 


0000 


1 


.000 


uS 


15 


200c4 


00H, 


mem read 


(ext) 


MON 


0000 


3 


. 000 


uS 


16 


200c5 


03xxH, 


mem read 


(ext) 


MON 


0000 


2 


. 000 


uS 


17 


2032f 


ebxxH, 


fetch 


(ext) 


MON 


0000 


2 


. 000 


uS 


18 


OOlle 


ebH, 


refresh 




MON 


0000 


1 


. 000 


uS 


19 


2032d 


BE 0331H 








0000 


0 


.280 


uS 



As you can see, monitor program is relocated to 20000H (physical 
address). 



Emulator Probe The descriptions in this section are of emulation tasks which 

SiCinal TODiCS involve emulator probe signals while in background or while 

" " accessing emulation memory. 



Allowing the Target 
System to Insert Wait 
States 



High-speed emulation memory provides no-wait-state operation. 
However, the emulator may optionally respond to the target system 
ready lines while emulation memory is being accessed. Use the cf 
(configuration) command with the rdy configuration item to cause 
emulation memory accesses to honor target system ready signals. 

R>cf rdy=lk 
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When the ready relationship is locked to the target system, 
emulation memory accesses honor ready signals from the target 
system (wait states are inserted if requested). 

To reconfigure so that emulation memory accesses do not honor 
target system ready signals, enter the following command. 

R>cf rdy=unlk 

When the ready relationship is not locked to the target system, 
emulation memory accesses ignore ready signals from the target 
system (no wait states are inserted). 



Target ROM 
Debug Topics 



The descriptions in this section are of emulation tasks which 
involve debugging target ROM. The tasks described below are 
made possible by the cim (copy target system memory image) 
command. The cim command allows you to read the contents of 
target memory into the corresponding emulation memory 
locations. Moving target ROM contents into emulation memory is 
the key which allows you to perform the tasks described below. For 
example, if target ROM exists at locations 400H through 0A38H, 
you can copy target ROM into emulation memory with the 
following commands. 

R>map 400..0bff erom 
R>cim 400 . . 0a38 



Using Software 
Breakpoints with 
ROMed Code 



You cannot define software breakpoints in target ROM memory. 
However, you can copy target ROM into emulation memory which 
does allow you to use software breakpoints. 



Once target ROM is copied into emulation memory, software 
breakpoints maybe used normally at addresses in these emulation 
memory locations. 

R>bc -e bp 
R>bp 440 
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Coverage Testing 
ROMed Code 



Coverage testing (as described in the "Getting Started" chapter) 
can only be performed on emulation memory. However, if you 
wish to perform coverage tests on code in target system ROM, you 
can copy target ROM into emulation memory and perform the 
coverage tests on your ROMed code. 

Once target ROM is copied into emulation memory, coverage 
testing maybe done normally at addresses in these emulation 
memory locations. 

U>cov -a 400 . . 0a38 



Modifying ROMed 
Code 



Suppose that, while debugging your target system, you begin to 
suspect a bug in some target ROM code. You might want to fix or 
"patch" this code before programming new ROMs. This can also be 
done by copying target system ROM into emulation memory with 
the cim (copy target memory image) command. Once the contents 
of target ROM are copied into emulation memory, you can modify 
emulation memory to "patch" your suspected code. 



Electrical 
Characteristics 



The AC characteristics of the HP 64731 A emulator are listed in the 
following table. 



Table 4-1 Electrical Specifications 



Characteristic 


Symbol 


uPD70322,70320 


HP 64731 A 


Unit 


Min 


Max 


Typical 


CLKOUT Width Low,High 


tWKH 
tWKL 


0.5T-15 




0.5T-25 


ns 


CLKOUT Rise andFAll Time 


tKR,tKF 




15 


25 


ns 


Address Valid to Data-in Valid (Read) 


tDADR 




(n+ 1.5)T-90 


(n+ 1.5)T-120 


ns 
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Table 4-1 Electrical Specifications(Cont'd) 



Characteristic 


Symbol 


uPD70322,70320 


HP 64731 A 


Unit 


Min 


Max 


Typical 


CLKOUT Width Low,High 


tWKH 
tWKL 


0.5T-15 




0.5T-25 


ns 


MREQ Asserted to Data-in 
Valid(Read) 


tDMRD 




(n+ l)T-75 


(n+ 1)T-105 


ns 


MSTB Asserted to Data-in 
Valid(Read) 


tDMSD 




(n+ 0.5)T-75 


(n+ 0.5)T-105 


ns 


IOSTB Asserted to Data-in 
Valid(Read) 


tDISD 




(n+ l)T-90 


(n+ 1)T-120 


ns 


READY Setup Time 


tSCRY 




(n-l)T-lOO 


(n-l)T-130 


ns 


HLDRQ Setup Time 


tSHQK 




30 


60 


ns 


INTP0-INTP2,DMARQ0-DMARQ 
Setup Time 


tSIQK 




30 


60 


ns 


POLL Set up Time 


tSPLK 




30 


60 


ns 


INT Setup Time 


tSIRK 




30 


60 


ns 



T: Cycle Time 

n: Wait-State Count 



In-Circuit Emulation 4-9 



Target System 
Interface 



P0(0:6) 



These signals are connected to 74HCT125 
and 74HCT573 and 100K ohm pull-down 
register. 



P0(7)/CLKOUT 



This signal is connected to 74HCT125 and 
74HCT573 and 10K ohm pull-up register in 
process with PORT mode. In other case, this 
signal is connected to 74FCT244 and 10K 
ohm pull-up register. 



P0(7 VCLKOUT 



P1(0) 



This signal is connected tp 74HCT14 and 
10K ohm pull-up register. 



+5V 



P 1 ( 0 ) 
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Pl(l:2) These signals are connected to 74HCT125 

and 10K ohm pull-up register. 



+5V 



PI ( 1 : 2 ) 




Pl(3:6) These signals are connected to 74HCT449 

and 100K ohm pull-down register. 



PI (3:6) 





74HCT449 









\yyy- 



Pl(7) This signal is connected to 74HCT125. 

74HCT125 



PI (7 ) 




74HCT125 



P2(0:7) These signals are connected to 74HCT449 

and 100K ohm pull-down register. 





74HCT449 
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PT(0:7) 



These signals are connected to LM339 and 
lOOOp farad condenser. 



Vth 



This signal is connected to MUX-16ET 
through 1.96K ohm series register and 
31.36K ohm pull-down register and lOOOp 
farad condenser. 



L96K MUX-1BET 



1000p <f 31 . 3Ek 



TftTT 



D0-D7 



These signals are connected to 74HCT645 
and 100K ohm pull-down register. 





74FCTB45 









A0-A7 



These signals are connected to 74HCT245 
and 100K ohm pull-down register. 



74HCT245 
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A8-A15 



These signals are connected to 74HCT245. 



A16-A19 



R8-R15 





74HCT245 









These signals are connected to 74HCT449. 





74HCT449 









R/WMSTB These signals are connected to 74FCT645 

MREQ IOSTB through 5 1 ohm series register. 



R/N MSTB 



MREQ IOSTB 



5 1 



74RCT645 



REFREQ 



TxDO TxDl 



This signal is connected to 74FCT645. 



RERREO 





74RCT645 









These signals are connected to 74HCT125. 

74HCT125 

TxD0 

TxDl 



RxDO RxDl These signals are connected to 74HCT125 

CTS1 and 10K ohm pull-up register. 



-ixLZ : <xt: 

CT51 
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CTSO 



RESET 



EA 




This signal is connected to 74HCT125 and 
100K ohm pull-down register. 



CTS0 




This signal is connected to 74HCT14 and 
10K ohm pull-up register. 

+5V 



RESET 




This signal is connected to 74HCT125 and 
10K ohm pull-up register. 



+5V 
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Restrictions And 
Considerations 



Interrupts While 
Executing Step 
Command 



While executing user program code in stepping, interrupts (include 
NMI, non-maskable interrupt) are suspended. If the interrupt and 
certain instruction execution which can not be interrupted occur 
simultaneously, the interrupt will be ignored completely. 



Note 




You should not use step command when if target system can 
generates interrupt. It's possible to be ignored interrupts. 



DMA Operation In case of the 70322/70320 microprocessor, internal ROM/RAM 
area can not become source/destination of DMA operation. 
External memory is accessed instead. However, the 70322/70320 
emulator accesses internal ROM/RAM area as DMA operation 
source or destination. 

For example, in case of actual processor (70322), if DMA 
operation from internal ROM area to target I/O is executed, 
external memory which is overlapping to internal ROM become 
data source. However, in case of the emulator, internal ROM 
becomes source instead. 



Load/Modify 
Operation to Internal 
ROM 



When you load the program to internal ROM area, the emulator 
stores to the internal ROM area. In addition, the emulator 
performs write operation to the target system. If your target system 
have memory on address area where the internal ROM resides, the 
emulator write to the memory when you load the code to internal 
ROM. This is true when you issue the command which performs 
the write operation to internal ROM (ie. "m" modify memory 
command). 
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Tracing Internal The address information when accessing internal RAM/SFR area, 
RAM/SFR AcceSS only lowest 8 bit is correct. Other higher 12 bit address information 

Cycles is unstable - 



If your program accesses internal RAM/SFR, emulation trace 
display shows you such cycles. However, displayed address 
information of internal RAM/SFR access cycle may differ from one 
you expect. In such case, only least 8 bit is certain. Rest 12 bit of 
address information maybe unreliable (have no meaning). 
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A 



70322/70320 Emulator Specific Command 
Syntax 



The following pages contain descriptions of command syntax 
specific to the 70322/70320 emulator. The following syntax items 
are included (several items are part of other command syntax): 

■ < ACCESS_MODE> . May be specified in the mo 
(display and access mode), m (memory), and io (I/O port) 
commands. The access mode specifies which resource you 
intend to access when resources are overlapped. 

■ <ADDRESS>. Maybe specified in emulation commands 
which allow addresses to be entered. 

. < CONFIG_ITEMS> . Maybe specified in the cf 
(emulator configuration) and help cf commands. 

M < DISPLAY_MODE> . May be specified in the mo 

(display and access mode), m (memory), io (I/O port), and 
ser (search memory for data) commands. The display 
mode is used when memory locations are displayed or 
modified. 

. < REG_NAME> and < REG_CLASS> . Maybe 
specified in the reg (register) command. 
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ACCESS MODE 



Summary This configuration item have special meaning to the HP 64731 

70322/70320 emulator. When your target microprocessor is 70322, 
there is internal ROM on chip. This internal ROM and internal 
RAM/SFR (Special Function Registers) can overlap. In such 
situation, you can specify which resource you want to access to. 



Syntax 




Function The < ACCESS_MODE> for the 70322/70320 emulator has a 
special meaning. The 70322 microprocessor have internal ROM 
(16 Kbyte) and internal RAM, SFR (Special Function Register) on 
memory space. The internal ROM and internal RAM/SFR can 
overlap each other. Upon reset, Internal ROM and internal 
RAM/SFR overlaps, since the IDB register is set to FFH (internal 
RAM start at FFE00H physical address). In such situation, you 
can specify the emulator to access which resource (internal ROM 
or internal RAM/SFR). 



Note 




This configuration item has no meaning when you select 70320 
microprocessor because 70320 does not incorporate ROM on chip, 



or internal RAM/SFR do not overlap with internal ROM. This 
configuration has meaning only when you select 70322 
microprocessor and internal RAM/SFR overlap with internal 
ROM. 
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Parameters 

i Access Internal RAM/SFR. Select internal 

RAM/SFR as object of command you requested. 
Setting this mode allow you to access 
(display/modify) internal RAM/SFR when it 
overlap with the internal ROM. 

b Access Internal ROM. Select internal ROM as 

object of command you requested. Setting this 
mode allow you to access (display/modify) 
internal ROM when it overlap with the internal 
RAM. 



Caution |HL This configuration item also affects the destination of load 

command. You must set this to "i" when you load your programs 
into internal ROM. Otherwise, if set to "b", your programs will be 
loaded into internal RAM/SFR. Keep this in your mind when 
loading programs into internal ROM. Since the emulator's default 
is "b" you must modify this configuration item to "i" prior to 
loading the program into internal ROM. 



Defaults The < ACCESS_MODE> is b at power up initialization. Access 
mode specifications are saved; that is, when a command changes 
the access mode, the new access mode becomes the current default. 

Related Commands mo (specify display and access modes) 
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ADDRESS 

Summary Address specifications used in emulation commands. 



Syntax 



< SEGMENT) 




<0FE5ET> 


<PHY5 RDDR> 


► 









Function The<ADDRESS> parameter used in emulation commands may 
be specified as a logical address or as a physical address (though a 
physical address in a run or step command is converted to a logical 
address by the emulation system). 



Parameters <segment> 



This expression is the segment portion of the 
logical address. The value specified is placed in 
the 70322/70320 PS register before running or 
stepping. 

< OFFSET> 

This expression is the offset portion of the 
logical address. The value specified is placed in 
the 70322/70320 PC register before running or 
stepping. 

< PHYS_ADDR> 

This expression is a physical address in the 
70322/70320 address range. In run and step 
commands, the emulation system converts this 
physical address to a logical address as specified 
by the rad (run address default) configuration 
item (see the < CONFIG_ITEM> description). 
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Expressions are defined in the HP 64700 Emulators Terminal 
Interface: User's Reference manual. 



Defaults If no number base is specified, values entered are interpreted as 
hexadecimal numbers. 



Examples The examples below show logical addresses being used in the run 
and step command as compared to physical addresses. 



M>s 2 Offff:0 

ffff:0000 ea00f400f0 JMP FAR PTR ff400 
f000:f400 b800f0 MOV AW, #f 000 

PC = f000:f403 
M>s 2 OffffO 

f000:fff0 ea00f400f0 JMP FAR PTR ff400 
f000:f400 b800f0 MOV AW, #f 000 

PC = f000:f403 



Related Commands r (run command) 



s (step command) 

< CONFIG_ITEMS> (70322/70320 specific items specified with 
the cf command) 
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CONFIG ITEMS 



Summary 70322/70320 emulator configuration items. 



Syntax 



loc ~y 



< 





unik ~y~ 







70320 y~ 

70322 y~ 




> 
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Function The < CONFIG_ITEMS> are the 70322/70320 specific 

configuration items which can be displayed/modified using the cf 
(emulator configuration) command. If the "= " portion of the 
syntax is not used, the current value of the configuration item is 
displayed. 



Parameters 



elk Clock Source. This configuration item allows 

you to specify whether the emulator clock source 
is to be internal (int, provided by the emulator) 
or external (ext, provided by the target system). 
The internal clock speed is 8 MHz (system clock, 
CLKOUT). The emulator will operate at 
external clock speed from 
4-16 MHz (entered clock or crystal frequency 
connected). 

rdy Allow Target Ready Signals to Insert Wait 

States. This configuration item allows you to 
specify whether the emulator should honor 
target system ready signals on accesses to 
emulation memory. Setting rdy equal to lk 
specifies that target ready signals be honored on 
emulation memory accesses. Setting rdy equal to 
unlk specifies that target ready signals be 
ignored on emulation memory accesses. 

loc Monitor Location. This configuration item 

allows you to specify the location of the monitor 
program. The monitor maybe located on any 
4K byte boundary. If the < ADDRESS> 
specified is not on a 4K boundary, the 4K 
boundary below the address is used. The 
location of background monitors maybe 
important because background cycles of the 
70322/70320 emulator are always visible to the 
target system. In default, the monitor is located 
on 00000H through 00FFFH (physical address). 
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Note 



4 



If your target system have some circuitry which monitors bus 
activities to detect illegal access to resources, You may need to 
relocate monitor address. 



rrt Restrict to Real-Time Runs. This configuration 

item allows you to specify whether program 
execution should take place in real-time or 
whether commands should be allowed to cause 
breaks to the monitor during program execution. 
To restrict execution to real-time, set rrt equal 
to en. To allow breaks to the monitor during 
program execution, set rrt equal to dis. When 
runs are restricted to real-time, commands which 
access target system resources (display registers, 
step, or display/modify target system memory or 
I/O) are not allowed. 

rad Physical to Logical Run Address Conversion. 

This configuration item allows you to specify the 
default method in which the emulation system 
will convert physical addresses specified in run 
and step commands to logical addresses. Setting 
rad equal to maxseg specifies that the low nibble 
of the physical address become the offset value; 
the high four nibbles become the segment value. 
Setting rad equal to minseg specifies that the 
low four nibbles of the physical address become 
the offset value; the high nibble and three hex 
zeros will become the segment value. 
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proc Microprocessor selection. This configuration 

item specifies microprocessor to be emulated. 
70320 or 70322 are available for microprocessor 
name. If you select 70322 as a microprocessor to 
be emulated, 16K byte of emulation memory will 
be mapped automatically as internal ROM area 
(however, this does not appear as mapper term). 
Therefore, rest 108K byte is available for 
emulation memory. If you select 70320 as target 
microprocessor, amount of 124K byte emulation 
memory is available. 

urst Specify whether accept or ignore reset signal 

from target system. If you specify en for this 
configuration item, emulator accept target 
system reset signal and execution will start from 
reset vector address as actual microprocessor 
does. This is true while running background 
monitor. If disabled with specifying dis, 
emulator always ignore target system reset signal 
regardless of foreground (executing user 
program) or background (executing monitor 
program). Reset signal from target system will 
be ignored completely. 
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Defaults The default values of the configuration items are listed below. 



cf clk=int 
cf rdy=unlk 
cf loc=0FF800 
cf rrt=dis 
cf rad=minseg 
cf proc=70322 
cf urst=en 



Related Commands help 



You can get an on line help information for particular 
configuration items by typing: 

R> help cf < CONFIG_ITEM> 
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DISPLAYMODE 



Summary Specify the memory display format or the size of memory locations 
to be modified. 



Syntax 



< 



Function The < DISPLAY_MODE> specifies the format of the memory 
display or the size of the memory which gets changed when 
memory is modified. 



Parameters 



w 



111 



Byte. Memory is displayed in a byte format, and 
when memory locations are modified, bytes are 
changed. 

Word. Memory is displayed in a word format, 
and when memory locations are modified, words 
are changed. 

Double Word. Memory is displayed in a double 
word format, and when memory locations are 
modified, double words are changed. 

Mnemonic. Memory is displayed in mnemonic 
format; that is, the contents of memory locations 
are inverse-assembled into mnemonics and 
operands. When memory locations are modified, 
the last non-mnemonic display mode 
specification is used. You cannot specify this 
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display mode in the ser (search memory for 
data) command. 



Defaults The < DISPLAY_MODE> is b at power up initialization. Display 
mode specifications are saved; that is, when a command changes 
the display mode, the new display mode becomes the current 
default. 

Related Commands mo (specify access and display modes) 

m (memory display/modify) 

io (I/O display/modify) 

ser (search memory for data) 
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REGISTERS 

Summary 70322/70320 register designators. Table A-l shows all available 
register class names and register names. 

< REG_CLASS> 

< REG_NAME> Description 
*(A11 basic registers) 

ah, al, aw BASIC registers. 

bh, bl, bw 

ch, cl, cw 

dh, dl, dw 

sp,bp, ix,iy 

dsO, dsl, ss 

pc, ps, psw 

port(Port registers) 



pO Port 0 

pmO Port 0 mode (Write Only) 

pmcO Port mode control (Write Only) 

pi Port 1 

pml Port 1 mode (Write Only) 

pmcl Port 1 mode control (Write Only) 

p2 Port 2 

pm2 Port 2 mode (Write Only) 

pmc2 Port 2 mode control (Write Only) 

pt Port T (Read Only) 

pmt Port T mode 
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intr(Interrupt registers) 



intm 


External interrupt mode 


emsO 


External interrupt macro service control 0 


emsl 


External interrupt macro sercice control 1 


ems2 


External interrupt macro sercice control 2 


exicO 


External interrupt request control 0 


exicl 


External interrupt request control 1 


exic2 


External interrupt request control 2 


ispr 


In service priority 


cri(Serial I/F registers) 


rxbO 


Recieve buffer 0 (Read Only) 


txbO 


Transmit buffer 0 (Write Only) 


srmsO 


Serial recieve macro service control 0 


stmsO 


Serial transmit macro service control 0 


scmO 


Serial mode 0 


sccO 


Serial control 0 


brgO 


Baud rate grnerater 0 


sceO 


Serial error (Read Only) 


seicO 


Serial error interrupt request control 0 


sricO 


Serial recieve interrupt request control 0 


sticO 


Serial transmit interrupt request control 0 


rxbl 


Recieve buffer 1 (Read Only) 


txbl 


Transmit buffer 1 (Write Only) 


srmsl 


Serial recieve macro service control 1 


stmsl 


Serial transmit macro service control 1 


scml 


Serial mode 1 


sccl 


Serial control 1 


brgl 


Baud rate grnerater 1 


seel 


Serial error (Read Only) 


seicl 


Serial error interrupt request control 1 


sricl 


Serial recieve interrupt request control 1 


sticl 


Serial transmit interrupt request control 1 
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tmr( Timer registers) 



tmO 


Timer 0 


mdO 


Modulo/Timer 0 


tml 


Timer 1 


mdl 


Modulo/Timer 1 


tmcO 


Timer control 0 


tmcl 


Timer control 1 


tmmsO 


Timer unit macro service control 0 


tmmsl 


Timer unit macro service control 1 


tmms2 


Timer unit mcro service control 2 


tmicO 


Timer unit interrupt request control 0 


tmicl 


Timer unit interrupt request control 1 


tmic2 


Timer unit interrupt request control 2 


dma(DMA control registers) 


dmacO 


DMA control 0 


dmamO 


DMA mode 0 


dmacl 


DMA control 1 


dmaml 


DMA mode 1 


dicO 


DMA interrupt request control 0 


dicl 


DMA interrupt request control 1 


Proc(Processor status register) 


stbc 


Standby control 


rfm 


Refresh mode 


vvtc 


Wait control 


flag 


User flag 


pre 


Processor control 


tbic 


Timer base interrupt control 


idb 


Internal data area base 
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Function The < REG_CLASS> names maybe used in the reg(register) 
command to display a class of 70433 registers. 

The < REG_NAME> names maybe used with the reg command to 
either display or modify the contents of 70433 registers. 

Refer to your 70433 use's manual for complete details on the use of 
the 70433 registers. 

Related Commands reg (register display/modify) 



Function The < REG_CLASS> names maybe used in the reg (register) 
command to display a class of 70322/70320 registers. 

The < REG_NAME> names maybe used with the reg command to 
either display or modify the contents of an 70322/70320 register. 

Refer to your 70322/70320 user's manual for complete details on 
the use of the 70322/70320 registers. 

Related Commands reg (register display/modify) 
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Index 



A absolute files, downloading, 2-12 
access internal RAM/SFR 

trace, 4-10 
access mode, specifying, 2-18 
ACCESS_MODE syntax, A-2 
ADDRESS syntax, A-4 
analyzer status 

predefined equates, 2-24 
assemblers, 2-9 

B b (break to monitor) command, 2-20 
background monitor, 3-5 

things to be aware of, 3-6 
be (break conditions) command, 2-22 
BNC connector, 3-4 
break conditions, 2-22 

after initialization, 2-6 
break on analyzer trigger, 3-4 
breakpoints 

See software breakpoints 
bus masters 

note on target system accesses of emulation memory, 2-8 

C cf (emulator configuration) command, 3-1 
characterization of memory, 2-7 
checksum error count, 2-13 

cim (copy target system memory image) command, 4-8 
elk (clock source) emulator configuration item, 4-4 
elk, emulator configuration, A-7 
clock source 

external, 4-4 

internal, 4-4 
CMB (coordinated measurement bus), 3-4 
CMOS target system components, protecting, 4-3 
cold start initialization, 2-7 

combining commands on a single command line, 2-16 
command files, 2-16 
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command groups, viewing help for, 2-4 
command recall, 2-17 

command syntax, specific to 70320/70322 emulator, A-l 
commands 

combining on a single command line, 2-16 
CONFIGJTEMS syntax, A-6 
configuration 

elk, A-7 

See also emulator configuration 

loc, A-7 

proc, A-9 

rad, A-8 

rdy, A-7 

rrt, A-8 

urst, A-9 
configuration (hardware) 

remote, 2-10 

standalone, 2-10 

transparent, 2-10 
configuration, installing the emulator, 2-2 
coordinated measurements, 3-4 
coprocessors 

note on target system access of emulation memory, 2-8 
cov (reset/display coverage) command, 2-27 
coverage testing, 2-27 

on ROMed code, 4-8 
cp (copy memory) command, 2-27 

D display mode, specifying, 2-18 
DISPLAY_MODE syntax, A-ll 
DMA cycles, 4-4 
DMA operation 

restriction, 4-10 
downloading absolute files, 2-12 
dual-port emulation memory, 3-2 



E emulation analyzer, 1-3 
emulation memory 

after initialization, 2-7 
dual-port, 3-2 

note on access by target system, 2-8 
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size of, 2-7 
emulation RAM and ROM, 2-7 
emulator 

feature list, 1-3 

purpose of, 1-1 
emulator configuration 

after initialization, 2-6 

on-line help for, 2-5 
emulator configuration items 

elk, 4-4 

loc, 3-6 

rad, 3-3 

rdy, 4-7 

rrt, 3-2 
emulator probe 

installing, 4-2 
emulator specific command syntax, A-l 
equates predefined for analyzer status, 2-24 
eram, memory characterization, 2-9 
erom, memory characterization, 2-9 
es (emulator status) command, 2-6 

escape character (default) for the transparent mode, 2-12 
EXECUTE (CMB signal), 3-5 

F file formats, absolute, 2-12 

G getting started, 2-1 

getting started, prerequisites, 2-2 
grd, memory characterization, 2-8 
guarded memory accesses, 2-8 
to vector table area, 3-6 



H halt instructions 

continuing after break to background monitor, 3-6 
hardware installation, 2-2 
help facility, using the, 2-4 
help information on system prompts, 2-5 
HP absolute files, downloading, 2-12 

I illegal opcode detection, 3-8 
in-circuit emulation, 4-1 
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init (emulator initialization) command, 2-6 
initialization, emulator, 2-6 

cold start, 2-7 

warm start, 2-6 
installation, hardware, 2-2 
Intel hexadecimal files, downloading, 2-13 
internal ROM 

load/modify, 4-10 

L labels (trace), predefined, 2-23 
linkers, 2-9 

load (load absolute file) command, 2-12 

load map, 2-9 

load/modify 

internal ROM, 4-10 
loc (monitor location) emulator configuration item, 3-6 
loc, emulator configuration, A-7 
local bus masters 

note on target system accesses of emulation memory, 2-8 
locating the monitor, 3-6 

logical run address, conversion from physical address to, 3-3 
lower byte accesses, 2-24 

M m (memory display/modification) , 2-11 

m (memory display/modification) command, 2-18 
macros 

after initialization, 2-7 

using, 2-17 
map (memory mapper) command, 2-8 
mapping memory, 2-7 

memory 

displaying in mnemonic format, 2-14 

dual-port emulation, 3-2 
memory characterization, 2-7 
memory map 

after initialization, 2-6 
memory, emulation 

note on access by target system, 2-8 
memory, mapping, 2-7 

mo (specify display and access modes) command, 2-18 
modifying ROMed code, 4-9 
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monitor 

background, 3-5 

locating the, 3-6 
monitor location 
relocation, 4-5 
monitor program, 3-5 
monitor program memory, size of, 2-7 
Motorola S-record files,downloading, 2-13 

O on-line help, using the, 2-4 

P physical run address, conversion to logical run address, 3-3 
predefined equates, 2-24 
predefined trace labels, 2-23 
prerequisites for getting started, 2-2 
probe cable 

See emulator probe 
proc, emulator configuration, A-9 
processor selection, 3-7 
prompts, 2-5 

help information on, 2-5 

using "es" command to describe, 2-6 

R rad (physical run address default) emulator config. item, 3-3 
rad, emulator configuration, A-8 
RAM 

mapping emulation or target, 2-8 
rdy (target system wait states) emulator configuration item, 4-7 
rdy, emulator configuration, A-7 
READY (CMB signal), 3-5 
real-time runs 

commands not allowed during, 3-3 

commands which will cause break, 3-2 

restricting the emulator to, 3-2 
recalling commands, 2-17 

reg (register display/modification) command, 2-15 

register commands, 1-3 

REGISTERS syntax, A-13 

relocatable files, 2-9 

relocate monitor location, 4-5 

remote configuration, 2-10 

rep (repeat) command, 2-17 

reset 
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target system, 3-7 
reset (emulator) 

commands which cause exit from, 2-29 
ROM 

debug of target, 4-8 

mapping emulation or target, 2-8 

writes to, 2-8 

rrt (restrict to real-time) emulator configuration item, 3-2 

rrt, emulator configuration, A-8 

rst (reset emulator) command, 2-29 

run address, conversion from physical address, 3-3 

S s (step) command, 2-15 
sample program 

description, 2-3 

load map listing, 2-9 

loading the, 2-10 
select microprocessor, 3-7 
ser (search memory) command, 2-19 
simple trigger, specifying, 2-24 
single byte interrupt (SBI), 2-20 
software breakpoints, 2-20 

after initialization, 2-6 

defining, 2-22 

using with ROMed code, 4-8 
standalone configuration, 2-10 
stat (emulation analyzer status) trace label, 2-24 
static discharge, protecting the emulator probe against, 4-2 
syntax (command), specific to 70320/70322 emulator, A-l 

T target system RAM and ROM, 2-9 
target system reset 

accept, ignore, 3-7 
Tektronix hexadecimal files, downloading, 2-13 
tg (specify simple trigger) command, 2-24 
tgout (trigger output) command, 3-4 
tl (trace list) command, 2-25 
tlb (display/modify trace labels) command, 2-23 
trace 

internal RAM/SFR access, 4-10 
trace labels, predefined, 2-23 
tram, memory characterization, 2-9 
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transfer utility, 2-12 

transparent configuration, 2-10 

transparent mode, 2-12 

trigl and trig2 internal signals, 3-4 

trigger 

break on, 3-4 

specifying a simple, 2-24 
TRIGGER (CMB signal), 3-5 
trom, memory characterization, 2-9 
ts (trace status) command, 2-24 

U urst, emulator configuration, A-9 

W wait states, allowing the target system to insert, 4-7 
warm start initialization, 2-6 

X x (execute) command, 3-4 
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Notes 
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